{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-16T23:26:48.725","vulnerabilities":[{"cve":{"id":"CVE-2025-62166","sourceIdentifier":"security-advisories@github.com","published":"2026-03-09T20:16:01.320","lastModified":"2026-03-13T19:39:08.153","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should be private. This vulnerability is fixed in 1.28.0."},{"lang":"es","value":"FreshRSS es un agregador RSS gratuito y autoalojable. Antes de la 1.28.0, un error en la lógica de autenticación relacionado con los tokens de autenticación maestros, esta restricción es eludida. Normalmente, solo la fuente del usuario predeterminado debería ser visible si la visualización anónima está habilitada, y las fuentes de otros usuarios deberían ser privadas. Esta vulnerabilidad está corregida en la 1.28.0."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*","versionEndExcluding":"1.28.0","matchCriteriaId":"D306446F-7568-4C35-BA5C-A344AA576F73"}]}]}],"references":[{"url":"https://github.com/FreshRSS/FreshRSS/commit/60cf5ea297a17db861e73cd65d7b7862bd6bcc24","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/FreshRSS/FreshRSS/pull/8165","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/FreshRSS/FreshRSS/releases/tag/1.28.0","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w743-fg6g-mhwh","source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"]}]}}]}